During an audit of a contract for computer security, a governmental auditor finds that a contractor has developed a system that could be the most advanced in the industry. If it seems that the contractor is charging the government for developmental cost of a system that might be sold to other organizations, what is the auditor's best course of action?
- Estimate the cost to develop the advanced security system and inform the contractor that it will be a disallowed cost.
- Exclude the observation from the engagement final communication because the contract was vague and the level of security is clearly acceptable.
- Estimate the added cost, report it to management, and suggest that management meet with its lawyers and the contractor to resolve differences.
- Compare the cost of the security program with previous costs incurred by governmental operations and inform the contractor that the difference will be a disallowed cost.